Generating session keys
A method and apparatus for generating shared session keys. The method and apparatus does not rely on strong random number generation. The first node sends a timestamp and random sequence to the second node. The second node generates a message authentication code (MAC) using this data and a shared secret key. The MAC is then used to encrypt a reply containing a second timestamp and second random sequence from the second node. The first node receives this message and decrypts it by generating the same MAC. Both nodes then generate a session key using the shared set of timestamps and random sequences.
1. A computer-implemented method comprising:
sending, to a first node from a second node, a first message comprising a first timestamp and a first random string;
calculating, by a processing device at the second node, a first message authentication code (MAC) using the first timestamp, the first random string, and a secret key shared between the first node and the second node;
decrypting, at the second node, a second message received from the first node in response to the first message, using the first MAC as a key to obtain a second timestamp and a second random string; and
generating, at the second node, a session key using a second MAC generated using the first timestamp, the first random string, the second timestamp and the second random string.
2. The computer-implemented method of claim 1 , further comprising:
ending a session key generation process when the second timestamp exceeds a threshold value.
3. The computer-implemented method of claim 1 , further comprising:
generating an acknowledgment message including a third MAC based on the first timestamp and the second timestamp encrypted using the session key.
4. The computer-implemented method of claim 1 , further comprising:
generating separate distinct acknowledgment messages for each of a plurality of nodes participating in a session using a MAC specific to each of the plurality of nodes.
5. A computer-implemented method comprising:
receiving, at a second node from a first node, a first message comprising a first timestamp and a first random string;
calculating, by a processing device at the second node, a first message authentication code (MAC) using the first timestamp, the first random string, and a secret key shared between the first node and the second node;
encrypting, at the second node, a second message comprising a second timestamp and a second random string using the first MAC as a key;
sending, to the first node from the second node, the encrypted second message; and
generating, at the second node, a session key using a second MAC generated using the first timestamp, the first random string, the second timestamp and the second random string.
6. The computer-implemented method of claim 5 , further comprising:
ending a session key generation process when the first timestamp exceeds a threshold value.
7. The computer-implemented method of claim 5 , further comprising:
decrypting an acknowledgment message including a third MAC based on the first timestamp and the second timestamp encrypted using the session key.
8. The computer-implemented method of claim 7 , further comprising:
verifying the session key by matching a decrypted value from the acknowledgment message with a known value.
9. The computer-implemented method of claim 5 , further comprising:
generating separate distinct acknowledgment messages for each of a plurality of nodes participating in a session using a MAC specific to each of the plurality of nodes.
10. A non-transitory computer readable storage medium, having instructions stored therein, which when executed, cause a processing device to perform a set of operations comprising:
sending, to a first node from a second node, a first message comprising a first timestamp and a first random string;
calculating, by the processing device at the second node, a first message authentication code (MAC) using the first timestamp, the first random string, and a secret key shared between the first node and the second node;
decrypting, at the second node, a second message received from the first node in response to the first message, using the first MAC as a key to obtain a second timestamp and a second random string; and
generating, at the second node, a session key using a second MAC generated using the first timestamp, the first random string, the second timestamp and the second random string.
11. The non-transitory computer readable storage medium of claim 10 , having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:
ending a session key generation process when the second timestamp exceeds a threshold value.
12. The non-transitory computer readable storage medium of claim 10 , having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:
generating an acknowledgment message including a third MAC based on the first timestamp and the second timestamp encrypted using the session key.
13. The non-transitory computer readable storage medium of claim 10 , having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:
generating separate distinct acknowledgment messages for each of a plurality of nodes participating in a session using a MAC specific to each of the plurality of nodes.
14. A non-transitory computer readable storage medium, having instructions stored therein, which when executed, cause a processing device to perform a set of operations comprising:
receiving, at a second node from a first node, a first message comprising a first timestamp and a first random string;
calculating, by the processing device at the second node, a first message authentication code (MAC) using the first timestamp, the first random string, and a secret key shared between the first node and the second node;
encrypting, at the second node, a second message comprising a second timestamp and a second random string using the first MAC as a key;
sending, to the first node from the second node, the encrypted second message; and
generating, at the second node, a session key using a second MAC generated using the first timestamp, the first random string, the second timestamp and the second random string.
15. The non-transitory computer readable storage medium of claim 14 , having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:
ending a session key generation process when the first timestamp exceeds a threshold value.
16. The non-transitory computer readable storage medium of claim 14 , having further instructions stored therein, which when executed perform a set of operations, further comprising:
decrypting an acknowledgment message including a third MAC based on the first timestamp and the second timestamp encrypted using the session key.
17. The non-transitory computer readable storage medium of claim 14 , having further instruction stored therein, which when executed perform a set of operations, further comprising:
verifying the session key by matching a decrypted value from the acknowledgment message with a known value.
18. A system comprising:
a first computer comprising:
a processing device; and
a first session key generator executable by the processing device to
send a first message to a second computer, the first message comprising a first timestamp and a first random string,
calculate a first message authentication code (MAC) using the first timestamp, the first random string, and a secret key shared between the first computer and the second computer,
decrypt a second message received from the second computer using the first MAC as a key to obtain a second timestamp and a second random string, and
generate a session key using a second MAC generated using the first timestamp, the first random string, the second timestamp and the second random string.
19. The system of claim 18 , further comprising:
the second computer coupled to a network and the first computer, the second computer comprising:
a second processing device; and
a second session key generator executable by the second processing device to:
generate the first MAC using the first timestamp and first string,
reply with the second message encrypted using the first MAC as a key, and
generate the session key using the second MAC.
20. The system of claim 18 , further comprising:
a third computer coupled to the network, the third computer comprising:
a third processing device; and
a third session key generator executable by the third processing device to
generate a second session key based on a first timestamp, the second timestamp, a third timestamp, the first random string, the second random string and a third random string based on a third message received from the second computer.